2 \usepackage{beamerthemeplainculight}

     2 \usepackage{beamerthemeplaincu}

     3 \usepackage[T1]{fontenc}

     3 %\usepackage[T1]{fontenc}

    74 \renewcommand{\slidecaption}{APP 04, King's College London, 16 October 2012}

    74 \renewcommand{\slidecaption}{APP 03, King's College London, 1 October 2013}

    86   \LARGE Privacy Policies (4)\\[-6mm] 

    86   \LARGE Privacy Policies (2)\\[-6mm] 

    98   Slides: & KEATS (also homework is there)\\

    94   Slides: & KEATS (also home work is there)\\

   109 \frametitle{Unix-Style Access Control}

   105 

   110 

   106 \begin{center}

   111 \begin{itemize}

   107 \includegraphics[scale=0.45]{pics/trainwreck.jpg}\\

   112 \item Q: ``I am using Windows. Why should I care?'' \\ A: In Windows you have similar AC:

   108 one general defence mechanism is\\\alert{\bf defence in depth}

   113 

   109 \end{center}

   114 \begin{center}

   110 

   115 \begin{tabular}{l}

   111   

   116 administrators group\\ 

   112 \end{frame}}

   117 \hspace{5mm}(has complete control over the machine)\\

   113 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   118 authenticated users\\

   114 

   119 server operators\\

   115 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   120 power users\\

   116 \mode<presentation>{

   121 network configuration operators\\

   117 \begin{frame}<1-2>[c]

   118 \frametitle{Defence in Depth}

   119 

   120 \begin{itemize}

   121 \item \alt<1>{overlapping}{{\LARGE\bf overlapping}} systems designed to provide\\ security even if one of them fails.

   122 \end{itemize}

   123 

   124 \only<2->{

   125 \begin{textblock}{11}(2,12)

   126 \small otherwise your ``added security'' can become the point of failure 

   127 \end{textblock}}

   128   

   129 \end{frame}}

   130 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   131 

   132 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   133 \mode<presentation>{

   134 \begin{frame}[c]

   135 \frametitle{PALs}

   136 

   137 \begin{itemize}

   138 \item \alert{Permissive Action Links} prevent unauthorised use of nuclear weapons (so the theory)

   139 \end{itemize}

   140 

   141 \begin{center}

   142 \includegraphics[scale=0.25]{pics/nuclear1.jpg}\hspace{3mm}

   143 \includegraphics[scale=0.25]{pics/nuclear2.jpg}

   144 \end{center}

   145   

   146   

   147 \onslide<3->{

   148 modern PALs also include a 2-person rule

   149 } 

   150  

   151  \only<2->{

   152 \begin{textblock}{11}(3,2)

   153 \begin{tikzpicture}

   154 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   155 {\begin{minipage}{8cm}

   156 US Air Force's Strategic Air Command worried that in times of need the 

   157 codes would not be available, so until 1977 quietly decided to set them 

   158 to 00000000\ldots

   159 \end{minipage}};

   160 \end{tikzpicture}

   161 \end{textblock}}

   162 

   163   

   164 \end{frame}}

   165 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   166 

   167 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   168 \mode<presentation>{

   169 \begin{frame}[c]

   170 

   171 \begin{itemize}

   172 \item until 1998, Britain had nuclear weapons that could be launched from airplanes\bigskip\pause

   173 

   174 \item these weapons were armed with a bicycle key

   175 

   176 \begin{center}

   177 \begin{tabular}[b]{c}

   178 \includegraphics[scale=1.05]{pics/britkeys1.jpg}\\

   179 \small nuclear weapon keys

   123 \end{center}\medskip

   181 \hspace{3mm}

   124 

   182 \begin{tabular}[b]{c}

   125 \item Modern versions of Windows have more fine-grained AC than Unix; they do not have a setuid bit, but

   183 \includegraphics[scale=0.35]{pics/britkeys2.jpg}\\

   126 have \texttt{runas} (asks for a password).\pause

   184 \small bicycle lock

   127 

   185 \end{tabular}

   128 \item OS-provided access control can \alert{\bf add} to your

   186 \end{center}\bigskip\pause

   129 security.

   187 

   130 \end{itemize}

   188 \item the current Trident nuclear weapons can be launched from a submarine without any code being transmitted

   131 

   189 \end{itemize}

   132   

   190   

   133 \end{frame}}

   191 \end{frame}}

   134 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   192 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   135 

   193 

   136 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   194 

   137 \mode<presentation>{

   195 

   138 \begin{frame}[c]

   196 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   139 \frametitle{\begin{tabular}{c}Network Applications:\\[-1mm] Privilege Separation\end{tabular}}

   197 \mode<presentation>{

   140 

   198 \begin{frame}[c]

   141 

   199 \frametitle{Access Control in Unix}

   142 \begin{center}

   200 

   201 \begin{itemize}

   202 \item access control provided by the OS

   203 \item authenticate principals (login)

   204 \item mediate access to files, ports, processes according to \alert{roles} (user ids)\\

   205 \item roles get attached with privileges\bigskip\\%

   206 \hspace{8mm}

   207 \begin{tikzpicture}

   208 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   209 {\begin{minipage}{8cm}

   210 \alert{principle of least privilege:}\\

   211 programs should only have as much privilege as they need 

   212 \end{minipage}};

   213 \end{tikzpicture}

   214 \end{itemize}

   215 

   216 \end{frame}}

   217 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   218 

   219 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   220 \mode<presentation>{

   221 \begin{frame}[c]

   222 \frametitle{Access Control in Unix (2)}

   223 

   224 \begin{itemize}

   225 \item the idea is to restrict access to files and therefore lower the consequences of an attack\\[1cm]\mbox{}

   226 \end{itemize}

   227 

   228 \begin{textblock}{1}(2.5,9.5)

   161 

   292 \end{itemize}

   162 \begin{itemize}

   293 

   163 \item the idea is make the attack surface smaller and 

   294 \end{frame}}

   164 mitigate the consequences of an attack

   295 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   165 \end{itemize}

   296 

   166 

   297 

   298 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   299 \mode<presentation>{

   300 \begin{frame}[c]

   301 \frametitle{Login Process}

   302 

   303 

   304 \begin{itemize}

   305 \item login processes run under UID $=$ 0\medskip 

   306 \begin{center}

   307 \texttt{ps -axl | grep login}

   308 \end{center}\medskip

   309 

   310 \item after login, shells run under UID $=$ user (e.g.~501)\medskip

   311 \begin{center}

   312 \texttt{id cu}

   313 \end{center}\medskip\pause

   314 

   315 \item non-root users are not allowed to change the UID --- would break 

   316 access control

   317 \item but needed for example for \texttt{passwd}

   318 \end{itemize}

   319 

   320 \end{frame}}

   321 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   322 

   323 

   324 

   325 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   326 \mode<presentation>{

   327 \begin{frame}[c]

   328 \frametitle{Setuid and Setgid}

   329 

   330 The solution is that unix file permissions are 9 + \underline{2 Bits}:

   331 \alert{Setuid} and \alert{Setgid} Bits

   332 

   333 \begin{itemize}

   334 \item When a file with setuid is executed, the resulting process will assume the UID given to the owner of the file. 

   335 \item This enables users to create processes as root (or another user).\bigskip

   336 

   337 \item Essential for changing passwords, for example.

   338 \end{itemize}

   339 

   340 \begin{center}

   341 \texttt{chmod 4755 fobar\_file}

   342 \end{center}

   171 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   347 

   172 \mode<presentation>{

   348 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   173 \begin{frame}[c]

   349 \mode<presentation>{

   174 \frametitle{Shared Access Control}

   350 \begin{frame}[c]

   175 

   351 \frametitle{\begin{tabular}{c}Privilege Separation in\\ OpenSSH\end{tabular}}

   176 \begin{center}

   352 

   177 \includegraphics[scale=0.7]{pics/pointsplane.jpg}

   353 \begin{center}

   354 \begin{tikzpicture}[scale=1]

   355   

   356   \draw[line width=1mm] (0, 1.1) rectangle (1.2,2);

   357   \draw (4.7,1) node {Internet};

   358   \draw (0.6,1.7) node {\footnotesize Slave};

   359   \draw[line width=1mm] (0, 0) rectangle (1.2,0.9);

   360   \draw (0.6,1.7) node {\footnotesize Slave};

   361   \draw (0.6,0.6) node {\footnotesize Slave};

   362   \draw (0.6,-0.5) node {\footnotesize \begin{tabular}{c}unprivileged\\[-1mm] processes\end{tabular}};

   363   \draw (-2.7,-0.4) node {\footnotesize \begin{tabular}{c}privileged\\[-1mm] process\end{tabular}};

   364   

   365   \draw[line width=1mm] (-1.8, 0) rectangle (-3.6,2);

   366   \draw (-2.9,1.7) node {\footnotesize Monitor};

   367 

   368   \draw[white] (1.7,1) node (X) {};

   369   \draw[white] (3.7,1) node (Y) {};

   370   \draw[red, <->, line width = 2mm] (X) -- (Y);

   371  

   372   \draw[red, <->, line width = 1mm] (-0.4,1.4) -- (-1.4,1.1);

   373   \draw[red, <->, line width = 1mm] (-0.4,0.6) -- (-1.4,0.9);

   374 

   375   \end{tikzpicture}

   180 \begin{textblock}{11}(10.5,10.5)

   378 \begin{itemize}

   181 \small

   379 \item pre-authorisation slave 

   182 To take an action you\\[-1mm] 

   380 \item post-authorisation\bigskip

   183 need at least either:

   381 \item 25\% codebase is privileged, 75\% is unprivileged

   184 \begin{itemize}

   382 \end{itemize}

   185 \item 1 CEO\\[-5mm]

   383 \end{frame}}

   186 \item 2 MDs, or\\[-5mm]

   384 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   187 \item 3 Ds

   385 

   188 \end{itemize}

   386 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   189 \end{textblock}

   387 \mode<presentation>{

   190 

   388 \begin{frame}[c]

   191 \end{frame}}

   389 \frametitle{Network Applications}

   192 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   390 

   193 

   391 ideally network application in Unix should be designed as follows:

   194 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   392 

   195 \mode<presentation>{

   393 \begin{itemize}

   196 \begin{frame}[c]

   394 \item need two distinct processes

   197 \frametitle{Lessons from Access Control}

   395 \begin{itemize}

   198 

   396 \item one that listens to the network; has no privilege

   199 Not just restricted to Unix:

   397 \item one that is privileged and listens to the latter only (but does not trust it)

   200 

   398  

   201 \begin{itemize}

   399 \end{itemize}

   202 \item if you have too many roles (i.e.~too finegrained AC), then 

   400 

   203 	hierarchy is too complex\\

   401 \item to implement this you need a parent process, which forks a child process

   204 	\textcolor{gray}{you invite situations like\ldots let's be root}\bigskip

   402 \item this child process drops privileges and listens to hostile data\medskip

   205 

   403 

   206 \item you can still abuse the system\ldots

   404 \item after authentication the parent forks again and the new child becomes the user

   207 

   405 \end{itemize}

   208 \end{itemize}

   406 

   209 

   407 

   210 \end{frame}}

   408 \end{frame}}

   211 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   409 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

   212 

   410 

   213 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   411 

   214 \mode<presentation>{

   412 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   215 \begin{frame}[c]

   413 \mode<presentation>{

   216 \frametitle{\begin{tabular}{@ {}c@ {}}A ``Cron''-Attack\end{tabular}}

   414 \begin{frame}[c]

   217 

   415 \frametitle{\begin{tabular}{@ {}c@ {}}Famous Security Flaws in Unix\end{tabular}}

   218 The idea is to trick a privileged person to do something on your behalf:

   416 

   219 

   417 

   220 \begin{itemize}

   418 \begin{itemize}

   221 \item root:\\\texttt{rm /tmp/*/*}\bigskip\bigskip\pause

   419 \item \texttt{lpr} unfortunately runs with root privileges; you had the option to delete files after printing \ldots\pause\pause

   222 

   420 \item for debugging purposes (FreeBSD) Unix provides a ``core dump'', but allowed to follow links \ldots\pause

   223 \footnotesize

   421 \item \texttt{mkdir foo} is owned by root\medskip

   224 \begin{minipage}{1.1\textwidth}

   422 \begin{center}

   225 \textcolor{gray}{the shell behind the scenes:}\\

   423 \texttt{-rwxr-xr-x  1 root  wheel /bin/mkdir}

   226 \textcolor{gray}{\texttt{rm /tmp/dir$_1$/file$_1$ /tmp/dir$_1$/file$_2$ /tmp/dir$_2$/file$_1$ \ldots}}\bigskip\\

   424 \end{center}\medskip

   227 

   425 it first creates an i-node as root and then changes to ownership to the user's id\\ \textcolor{gray}{\small (automated with a shell script)}

   228 \textcolor{gray}{this takes time}

   426 \end{itemize}

   229 \end{minipage}

   427 

   230 \end{itemize}

   428 \only<1>{

   231 

   429 \begin{textblock}{1}(3,3)

   232 

   233 \end{frame}}

   234 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   235 

   236 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   237 \mode<presentation>{

   238 \begin{frame}[c]

   239 \frametitle{\begin{tabular}{@ {}c@ {}}A ``Cron''-Attack\end{tabular}}

   240 

   241 \begin{enumerate}

   242 \item attacker \textcolor{gray}{(creates a fake passwd file)}\\ 

   243 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}\medskip

   244 \item root \textcolor{gray}{(does the daily cleaning)}\\

   245 \texttt{rm /tmp/*/*}\medskip\\

   246 \hspace{2cm}\textcolor{gray}{\small records that \texttt{/tmp/a/passwd}}\\ 

   247 \hspace{2cm}\textcolor{gray}{\small should be deleted, but does not do it yet}\medskip\\

   248 

   249 \item attacker \textcolor{gray}{(meanwhile deletes the fake passwd file, and establishes a link to 

   250 the real passwd file)}\\

   251 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}\\

   252 \item root now deletes  the real passwd file

   253 \end{enumerate}

   254 

   255 \only<2>{

   256 \begin{textblock}{11}(2,5)

   259 {\normalsize\color{darkgray}

   432 {\begin{minipage}{8cm}

   260 \begin{minipage}{9cm}\raggedright

   433 Only failure makes us experts.

   261 To prevent this kind of attack, you need additional

   434 	-- Theo de Raadt (OpenBSD, OpenSSH)

   262 policies (don't do such operations as root).

   267 \end{frame}}

   439 

   268 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   440 

   269 

   441 \end{frame}}

   270 

   442 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   271 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   443 

   272 \mode<presentation>{

   444 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   273 \begin{frame}[c]

   445 \mode<presentation>{

   274 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier Analysis\end{tabular}}

   446 \begin{frame}[c]

   275 

   447 \frametitle{\begin{tabular}{@ {}c@ {}}Other Problems\end{tabular}}

   276 \textcolor{gray}{There is no absolutely secure system and security almost never comes for free.}

   448 

   277 

   449 There are thing's you just cannot solve on the programming side:\bigskip

   278 \begin{itemize}

   450 

   279 \item What assets are you trying to protect?

   451 \begin{itemize}

   280 \item What are the risks to these assets?

   452 \item for system maintenance you often have \texttt{cron}-jobs cleaning \texttt{/tmp}\medskip

   281 \item How well does the security solution mitigate those risks?

   453 \begin{itemize}

   282 \item What other risks does the security solution cause?

   454 \item attacker:\\ 

   283 \item What costs and trade-offs does the security solution impose?

   455 \texttt{mkdir /tmp/a; cat > /tmp/a/passwd}

   284 \end{itemize}

   456 \item root:\\\texttt{rm /tmp/*/*}:

   285 

   457 \item attacker:\\

   286 

   458 \texttt{rm /tmp/a/passwd; rmdir /tmp/a;}\\\texttt{ln -s /etc /tmp/a}

   287 \end{frame}}

   459 \end{itemize}

   288 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   460 \end{itemize}

   289 

   461 

   290 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   462 \end{frame}}

   291 \mode<presentation>{

   463 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   292 \begin{frame}[t]

   464 

   293 \frametitle{\begin{tabular}{@ {}c@ {}}Example: Credit Cards\end{tabular}}

   465 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   294 

   466 \mode<presentation>{

   295 You might have the policy of not typing in your credit card online. Worthwhile or not?

   467 \begin{frame}[c]

   296 \begin{itemize}

   468 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels\end{tabular}}

   297 \item<2->What assets are you trying to protect?\\

   469 

   298 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}your credit card number\end{tabular}}

   470 Unix essentially can only distinguish between two security levels (root and non-root).

   299 \item<3->What are the risks to these assets?\\

   471 

   300 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   472 \begin{itemize}

   301 With credit cards you loose a fixed amount \pounds{50}. Amazon \pounds{50}. \end{tabular}}

   473 \item In military applications you often have many security levels (top-secret, secret, confidential, unclassified)\bigskip\pause 

   302 \item<4->How well does the security solution mitigate those risks?\\

   474 

   303 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   475 \item Information flow: Bell --- La Padula model

   304 Well, hackers steal credit cards from databases. They usually do not attack you individually.\end{tabular}}

   476 

   305 \item<5->What other risks does the security solution cause?

   477 \begin{itemize}

   306 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright None (?)\end{tabular}}

   478 \item read: your own level and below

   307 \item<6->What costs and trade-offs does the security solution impose?

   479 \item write: your own level and above

   308 \only<6>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright Internet shopping is convenient and sometimes cheaper.\end{tabular}}

   480 \end{itemize}

   309 \item<7>[]{\bf\large No!}

   481 \end{itemize}

   310 \end{itemize}\pause\pause

   482 

   311 

   483 \end{frame}}

   312 

   484 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   313 \end{frame}}

   485 

   314 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   486 

   315 

   487 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   316 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   488 \mode<presentation>{

   317 \mode<presentation>{

   489 \begin{frame}[c]

   318 \begin{frame}[c]

   490 \frametitle{\begin{tabular}{@ {}c@ {}}Security Levels (2)\end{tabular}}

   319 \frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewalls\end{tabular}}

   491 

   320 

   492 \begin{itemize}

   321 \begin{center}

   493 \item Bell --- La Padula preserves data secrecy, but not data integrity\bigskip\pause

   322 \includegraphics[scale=0.5]{pics/firewall.png}

   494 

   323 \end{center}

   495 \item Biba model is for data integrity  

   324 

   496 

   325 A firewall is a piece of software that controls incoming and outgoing traffic according to some rules. 

   497 \begin{itemize}

   326 \end{frame}}

   498 \item read: your own level and above

   327 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   499 \item write: your own level and below

   328 

   500 \end{itemize}

   329 

   501 \end{itemize}

   330 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   502 

   331 \mode<presentation>{

   503 \end{frame}}

   332 \begin{frame}[t]

   504 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   333 \frametitle{\begin{tabular}{@ {}c@ {}}Example: Firewalls\end{tabular}}

   505 

   334 

   506 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   335 \begin{itemize}

   507 \mode<presentation>{

   336 \item<1->What assets are you trying to protect?\\

   508 \begin{frame}[c]

   337 \only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Whatever is behind the firewall 

   509 \frametitle{\begin{tabular}{@ {}c@ {}}Access Control in 2000\end{tabular}}

   338 (credit cards, passwords, blueprints, \ldots)\end{tabular}}

   510 

   339 \item<2->What are the risks to these assets?\\

   511 According to Ross Anderson (1st edition of his book), some senior Microsoft people held the

   340 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   512 following view:

   341 With a small online shop you are already at risk. Pentagon, definitely.\end{tabular}}

   513 

   342 \item<3->How well does the security solution mitigate those risks?\\

   514 \begin{center}

   343 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   344 Well, at home so not much. Everywhere else, if properly configurated then it does.\end{tabular}}

   345 \item<4->What other risks does the security solution cause?

   346 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright There might be backdoors or bugs in the firewall,

   347 but generally they are secure. You choose to prevent certain traffic.\end{tabular}}

   348 \item<5->What costs and trade-offs does the security solution impose?

   349 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright 

   350 Minimal to modest. Firewalls are part of free software. You need a knowledgeable 

   351 person to set them up.\end{tabular}}

   352 \item<7>[]{\bf\large Yes!}

   353 \end{itemize}\pause\pause

   354 

   355 

   356 \end{frame}}

   357 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   358 

   359 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   360 \mode<presentation>{

   361 \begin{frame}[t]

   362 \frametitle{\begin{tabular}{@ {}c@ {}}Ex: Two-Factor Authentication\end{tabular}}

   363 

   364 Google uses nowadays two-factor authentication. But it is an old(er)

   365 idea. It is used for example in Germany and Netherlands for online transactions.

   366 

   367 \begin{center}

   368 \includegraphics[scale=0.6]{pics/tan1.jpg}\hspace{5mm}

   369 \includegraphics[scale=0.2]{pics/tan2.jpg}

   370 \end{center}

   371 

   372 \pause

   373 Or nowadays by SMS (restricts the validity of the numbers) or with a secure generator

   374 

   375 \begin{center}

   376 \includegraphics[scale=0.08]{pics/pinsentry.jpg}

   377 \end{center}

   378 

   379 \end{frame}}

   380 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   381 

   382 

   383 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   384 \mode<presentation>{

   385 \begin{frame}[t]

   386 \frametitle{\begin{tabular}{@ {}c@ {}}Ex: Two-Factor Authentication\end{tabular}}

   387 

   388 \begin{itemize}

   389 \item<1->What assets are you trying to protect?\\

   390 \only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Your bank account.\end{tabular}}

   391 \item<2->What are the risks to these assets?\\

   392 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   393 Nowadays pretty high risk.\end{tabular}}

   394 \item<3->How well does the security solution mitigate those risks?\\

   395 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   396 It prevents problems when passwords are stolen. Man-in-the-middle attacks 

   397 still possible.\end{tabular}}

   398 \item<4->What other risks does the security solution cause?

   399 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright Your mobile phone or credit card/pin might 

   400 be stolen. SIM card becomes more valuable.\end{tabular}}

   401 \item<5->What costs and trade-offs does the security solution impose?

   402 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright 

   403 Banks need to establish an infrastructure. For you it might be inconvenient.\end{tabular}}

   404 \item<7>[]{\bf\large Yes!}

   405 \end{itemize}

   406 

   407 

   408 \end{frame}}

   409 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   410 

   411 

   412 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   413 \mode<presentation>{

   414 \begin{frame}[t]

   415 \frametitle{\begin{tabular}{@ {}c@ {}}Security Seals\end{tabular}}

   416 

   417 According to Ross Anderson: ``\ldots is a tamper-indicating device 

   418 designed to leave non-erasable, unambiguous evidence of unauthorized 

   419 entry or tampering.''

   420 

   421 \begin{center}

   422 \includegraphics[scale=0.45]{pics/seal.jpg}

   423 \end{center}\mbox{}\\[-12mm]

   424 

   425 They also need some quite sophisticated policies (seal regiment).

   426 \end{frame}}

   427 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   428 

   429 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   430 \mode<presentation>{

   431 \begin{frame}[t]

   432 \frametitle{\begin{tabular}{@ {}c@ {}}Security Seals (2)\end{tabular}}

   433 

   434 \begin{itemize}

   435 \item at the Argonne National Laboratory they tested 244 different security seals

   436 \begin{itemize}

   437 \item meantime to break the seals for a trained person: 100 s 

   438 \item including 19\% that were used for safeguard of nuclear material

   439 \end{itemize}\bigskip

   440 

   441 \item Andrew Appel defeated all security seals which were supposed to keep 

   442 voting machines safe

   443 \end{itemize}

   444 

   445 

   446 \only<2>{

   447 \begin{textblock}{11}(1,1)

   450 {\normalsize

   517 {\begin{minipage}{10.5cm}

   451 \begin{minipage}{11cm}\raggedright\small

   518 \small Access control does not matter. Computers are becoming single-purpose

   452 \begin{center}

   519 or single-user devices. Single-purpose devices, such as Web servers that deliver a single service, don't 

   453 \includegraphics[scale=0.25]{pics/appelseals.jpg}

   520 need much in the way of access control as there's nothing for operating system access controls

   454 \end{center}

   521 to do; the job of separating users from each other is best left to application code. As for the PC

   455 \begin{center}

   522 on your desk, if all the software on it comes from a single source, then again there's no need 

   456 \begin{minipage}{10.5cm}

   523 for the operating system to provide separation. \hfill{}\textcolor{gray}{(in 2000)} 

   457 \begin{itemize}

   458 \item The tamper-indicating tape can be lifted using a heat gun.

   459 \item The security screw cap can be removed using a screwdriver, then the

   460 serial-numbered top can be replaced (undamaged) onto a fresh (unnumbered) base.

   461 \item The wire seal can be defeated using a \#4 wood screw.

   462 \item The plastic strap seal can be picked using a jeweler's screwdriver.

   463 \end{itemize}

   464 \end{minipage}

   465 \end{center}

   468 \end{textblock}}

   526 \end{center}

   477 \frametitle{\begin{tabular}{@ {}c@ {}}Example: Security Seals\end{tabular}}

   535 \frametitle{\begin{tabular}{@ {}c@ {}}Research Problems\end{tabular}}

   478 

   536 

   479 \begin{itemize}

   537 \begin{itemize}

   480 \item<1->What assets are you trying to protect?\\

   538 \item with access control we are back to 1970s\bigskip

   481 \only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Voting machines, doors.\end{tabular}}

   539 

   482 \item<2->What are the risks to these assets?\\

   540 \only<1>{

   483 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright Casual thieves, insider attacks.\end{tabular}}

   541 \begin{tikzpicture}

   484 \item<3->How well does the security solution mitigate those risks?\\

   542 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   485 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   543 {\begin{minipage}{10cm}

   486 Needs a quite complicated security regiment.\end{tabular}}

   544 \small Going all the way back to early time-sharing systems we systems people regarded the users, and any code they wrote, as the mortal enemies of us and each other. We were like the police force in a violent slum.\\

   487 \item<4->What other risks does the security solution cause?

   545 \mbox{}\hfill--- Roger Needham

   488 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright You might not notice tampering.\end{tabular}}

   546 \end{minipage}};

   489 \item<5->What costs and trade-offs does the security solution impose?

   547 \end{tikzpicture}}\pause

   490 \only<5>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright 

   548 

   491 The ``hardware'' is cheap, but indirect costs can be quite high.\end{tabular}}

   549 \item the largest research area in access control in 2000-07 has been ``Trusted Computing'', but thankfully it

   492 \item<7>[]{\bf\large No!} {\textcolor{gray}{Though in some areas they work: airports, swimming pools, \ldots}}

   550 is dead now\bigskip

   493 \end{itemize}

   551 \item a useful research area is to not just have robust access control, but also usable access control --- by programmers and users\\ 

   494 

   552 (one possible answer is operating system virtualisation, e.g.~Xen, VMWare)\medskip\pause

   495 

   553 

   554 \item electronic voting

   555 \end{itemize}

   502 \frametitle{\begin{tabular}{@ {}c@ {}}Ex: Security-by-Obscurity\end{tabular}}

   562 \frametitle{\begin{tabular}{@ {}c@ {}}Mobile OS\end{tabular}}

   503 

   563 

   504 You might think it is a good idea to keep a security relevant algorithm or 

   564 \begin{itemize}

   505 software secret.

   565 \item iOS and Android solve the defence-in-depth problem by \alert{sandboxing} applications\bigskip

   506 

   566 

   507 \begin{itemize}

   567 \item you as developer have to specify the resources an application needs

   508 \item<1->What assets are you trying to protect?\\

   568 \item the OS provides a sandbox where access is restricted to only these resources

   509 \only<1>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}Source code, an algorithm and things that depend on it\end{tabular}}

   569 \end{itemize}

   510 \item<2->What are the risks to these assets?\\

   570 \end{frame}}

   511 \only<2>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   571 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   512 Can be pretty high (Oystercards).\end{tabular}}

   572 

   513 \item<3->How well does the security solution mitigate those risks?\\

   573 

   514 \only<3>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright

   574 

   515 Not really. The source code can be reverse engineered, stolen, coerced \ldots{}\end{tabular}}

   575 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   516 \item<4->What other risks does the security solution cause?

   576 \mode<presentation>{

   517 \only<4>{\begin{tabular}{@{\hspace{1cm}}p{9cm}}\raggedright You prevent

   577 \begin{frame}[c]

   518 scrutiny and independent advice. You also more likely than not to

   578 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theatre\end{tabular}}

   519 get it wrong.\end{tabular}}

   579 

   520 \item<5>[]{\bf\large No!}

   580 

   521 \end{itemize}

   581 Security theatre is the practice of investing in countermeasures intended to provide the 

   522 

   582 \underline{feeling} of improved security while doing little or nothing to actually achieve it.\hfill{}\textcolor{gray}{Bruce Schneier}

   523 

   583 

   524 \end{frame}}

   584 \end{frame}}

   525 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   585 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   526 

   586 

   527 

   587 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   528 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   588 \mode<presentation>{

   529 \mode<presentation>{

   589 \begin{frame}[c]

   530 \begin{frame}[t]

   590 \frametitle{\begin{tabular}{@ {}c@ {}}Security Theatre\end{tabular}}

   531 \frametitle{\begin{tabular}{@ {}c@ {}}Voting as Security Problem\end{tabular}}

   591 

   532 

   592 \begin{itemize}

   533 What are the security requirements of a voting system?\bigskip

   593 \item for example, usual locks and strap seals are security theatre

   534 

   594 \end{itemize}

   535 \begin{itemize}

   595 

   536 \item<2->Integrity 

   596 \begin{center}

   537 \item<3->Ballot Secrecy

   597 \includegraphics[scale=0.45]{pics/seal.jpg}

   538 \item<5->Voter Authentication

   598 \end{center}

   539 \item<6->Enfranchisement

   599 

   540 \item<7->Availability

   600 

   541 \end{itemize}

   601 \end{frame}}

   602 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   603 

   604 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   605 \mode<presentation>{

   606 \begin{frame}[c]

   607 

   608 \begin{minipage}{11cm}

   609 From: Ross Anderson <Ross.Anderson@cl.cam.ac.uk>\\

   610 To: cl-security-research@lists.cam.ac.uk\\

   611 Subject: Tip off\\

   612 Date: Tue, 02 Oct 2012 13:12:50 +0100\\

   613 

   614 I received the following tip off, and have removed the sender's

   615 coordinates. I suspect it is one of many security vendors who

   616 don't even get the basics right; if you ever go to the RSA 

   617 conference, there are a thousand such firms in the hall, each

   618 with several eager but ignorant salesmen. A trying experience.\\

   619 

   620 Ross

   621 \end{minipage}

   622 

   623 \end{frame}}

   624 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   625 

   626 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   627 \mode<presentation>{

   628 \begin{frame}[c]

   629 

   630 \begin{minipage}{11cm}

   631 I'd like to anonymously tip you off about this\\

   632 product:\\

   633 

   634 {\small http://www.strongauth.com/products/key-appliance.html}\\

   635 

   636 It sounds really clever, doesn't it?\\

   637 \ldots\\

   638 

   639 Anyway, it occurred to me that you and your colleagues might have a

   640 field day discovering weaknesses in the appliance and their

   641 implementation of security.  However, whilst I'd be willing to help

   642 and/or comment privately, it'd have to be off the record ;-)

   643 \end{minipage}

   644 

   645 \end{frame}}

   646 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   647 

   648 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   649 \mode<presentation>{

   650 \begin{frame}[c]

   651 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 1\end{tabular}}

   652 

   653 {\bf What assets are you trying to protect?}\bigskip

   654 

   655 This question might seem basic, but a surprising number of people never ask it. The question involves understanding the scope of the problem. For example, securing an airplane, an airport, commercial aviation, the transportation system, and a nation against terrorism are all different security problems, and require different solutions.

   546 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered] 

   659 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

   547 {\small

   660 {\begin{minipage}{10cm}

   548 \begin{minipage}{5cm}\raggedright

   661 \small You like to prevent: ``It would be terrible if this sort of attack ever happens; we need to do everything in our power to prevent it.''

   549 \begin{center}

   550 \begin{minipage}{4.5cm}

   551 \begin{itemize}

   552 \item The outcome matches with the voters' intend.

   553 \item There might be gigantic sums at stake and need to be defended against.

   554 \end{itemize}

   555 \end{minipage}

   556 \end{center}

   558 \end{tikzpicture}

   663 \end{tikzpicture}}

   559 \end{textblock}}

   664 \end{frame}}

   560 

   665 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   561 \only<4>{

   666 

   562 \begin{textblock}{5.5}(8,5)

   667 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   563 \begin{tikzpicture}

   668 \mode<presentation>{

   564 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered] 

   669 \begin{frame}[c]

   565 {\small

   670 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 2\end{tabular}}

   566 \begin{minipage}{5cm}\raggedright

   671 

   567 \begin{center}

   672 {\bf What are the risks to these assets?}\bigskip

   568 \begin{minipage}{4.5cm}

   673 

   569 \begin{itemize}

   674 Here we consider the need for security. Answering it involves understanding what is being defended, what the consequences are if it is successfully attacked, who wants to attack it, how they might attack it, and why.

   570 \item Nobody can find out how you voted.

   675 

   571 \item (Stronger) Even if you try, you cannot prove how you voted.

   676 \end{frame}}

   572 \end{itemize}

   677 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   573 \end{minipage}

   678 

   574 \end{center}

   679 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   575 \end{minipage}};

   680 \mode<presentation>{

   576 \end{tikzpicture}

   681 \begin{frame}[c]

   577 \end{textblock}}

   682 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 3\end{tabular}}

   578 

   683 

   579 \only<5>{

   684 {\bf How well does the security solution mitigate those risks?}\bigskip

   580 \begin{textblock}{5.5}(8,5)

   685 

   581 \begin{tikzpicture}

   686 Another seemingly obvious question, but one that is frequently ignored. If the security solution doesnÕt solve the problem, it's no good. This is not as simple as looking at the security solution and seeing how well it works. It involves looking at how the security solution interacts with everything around it, evaluating both its operation and its failures.

   582 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered] 

   687 

   583 {\small

   688 \end{frame}}

   584 \begin{minipage}{5cm}\raggedright

   689 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   585 \begin{center}

   690 

   586 \begin{minipage}{4.5cm}

   691 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   587 \begin{itemize}

   692 \mode<presentation>{

   588 \item Only authorised voters can vote up to the permitted number of votes.

   693 \begin{frame}[c]

   589 \end{itemize}

   694 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 4\end{tabular}}

   590 \end{minipage}

   695 

   591 \end{center}

   696 {\bf What other risks does the security solution cause?}\bigskip

   592 \end{minipage}};

   697 

   593 \end{tikzpicture}

   698 This question addresses what might be called the problem of unintended consequences. Security solutions have ripple effects, and most cause new security problems. The trick is to understand the new problems and make sure they are smaller than the old ones.

   594 \end{textblock}}

   699 

   595 

   700 \end{frame}}

   596 \only<6>{

   701 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   597 \begin{textblock}{5.5}(8,5)

   702 

   598 \begin{tikzpicture}

   703 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   599 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered] 

   704 \mode<presentation>{

   600 {\small

   705 \begin{frame}[c]

   601 \begin{minipage}{5cm}\raggedright

   706 \frametitle{\begin{tabular}{@ {}c@ {}}Schneier: Step 5\end{tabular}}

   602 \begin{center}

   707 

   603 \begin{minipage}{4.5cm}

   708 {\bf What costs and trade-offs does the security solution impose?}\bigskip

   604 \begin{itemize}

   709 

   605 \item Authorised voters should have the opportunity to vote.

   710 Every security system has costs and requires trade-offs. Most security costs money, sometimes substantial amounts; but other trade-offs may be more important, ranging from matters of convenience and comfort to issues involving basic freedoms like privacy. Understanding these trade-offs is essential.

   606 \end{itemize}

   607 \end{minipage}

   608 \end{center}

   609 \end{minipage}};

   610 \end{tikzpicture}

   611 \end{textblock}}

   612 

   613 \only<7>{

   614 \begin{textblock}{5.5}(8,5)

   615 \begin{tikzpicture}

   616 \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm, text centered] 

   617 {\small

   618 \begin{minipage}{5cm}\raggedright

   619 \begin{center}

   620 \begin{minipage}{4.5cm}

   621 \begin{itemize}

   622 \item The voting system should accept all authorised votes and produce results in a timely manner.

   623 \end{itemize}

   624 \end{minipage}

   625 \end{center}

   626 \end{minipage}};

   627 \end{tikzpicture}

   628 \end{textblock}}

   629 

   630 \end{frame}}

   631 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   632 

   633 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   634 \mode<presentation>{

   635 \begin{frame}[t]

   636 \frametitle{\begin{tabular}{@ {}c@ {}}Ballot Boxes\end{tabular}}

   637 

   638 

   639 \begin{center}

   640 \includegraphics[scale=2.5]{pics/ballotbox.jpg}

   641 \end{center}

   642 

   643 

   644 \end{frame}}

   645 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   646 

   647 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   648 \mode<presentation>{

   649 \begin{frame}[t]

   650 \frametitle{\begin{tabular}{@ {}c@ {}}Problems with Voting\end{tabular}}

   651 

   652 

   653 \begin{center}\large

   654 \begin{tabular}{rcl}

   655 Integrity & vs. & Ballot Secrecy\bigskip\\

   656 Authentication & vs. &Enfranchisement   

   657 \end{tabular}

   658 \end{center}\bigskip\bigskip\pause

   659 

   660 Further constraints:

   661 

   662 \begin{itemize}

   663 \item costs

   664 \item accessibility

   665 \item convenience

   666 \item intelligibility 

   667 \end{itemize}

   668 \end{frame}}

   669 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   670 

   671 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   672 \mode<presentation>{

   673 \begin{frame}[t]

   674 \frametitle{\begin{tabular}{@ {}c@ {}}E-Voting\end{tabular}}

   675 

   676 

   677 \begin{itemize}

   678 \item The Netherlands between 1997 - 2006 had electronic voting machines\\

   679 \textcolor{gray}{(hacktivists had found: they can be hacked and also emitted radio signals revealing how you voted)}

   680 

   681 \item Germany had used them in pilot studies\\ 

   682 \textcolor{gray}{(in 2007 a law suit has reached the highest court and it rejected electronic voting

   683 on the grounds of not being understandable by the general public)}

   684 

   685 \item UK used optical scan voting systems in a few polls

   686 \end{itemize}

   687 \end{frame}}

   688 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   689 

   690 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   691 \mode<presentation>{

   692 \begin{frame}[t]

   693 \frametitle{\begin{tabular}{@ {}c@ {}}E-Voting\end{tabular}}

   694 

   695 \mbox{}\\[-12mm]

   696 \begin{itemize}

   697 \item US used mechanical machines since the 30s, later punch cards, now DREs and 

   698 optical scan voting machines \textcolor{gray}{(fantastic ``ecosystem'' for study)}

   699 

   700 \item Estonia used in 2007 the Internet for national elections 

   701 \textcolor{gray}{(there were earlier pilot studies in other countries)}

   702 

   703 \item India uses e-voting devices  since at least 2003\\

   704 \textcolor{gray}{(``keep-it-simple'' machines produced by a government owned company)}

   705 

   706 \item South Africa used software for its tallying in the 1993 elections (when Nelson Mandela was elected)

   707 \textcolor{gray}{(they found the tallying software was rigged, but they were able to tally manually)}

   708 \end{itemize}

   709 \end{frame}}

   710 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   711 

   712 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   713 \mode<presentation>{

   714 \begin{frame}[t]

   715 \frametitle{\begin{tabular}{@ {}c@ {}}A Brief History of Voting\end{tabular}}

   716 

   717 

   718 \begin{itemize}

   719 \item Athenians

   720 \begin{itemize}

   721 \item show of hands

   722 \item ballots on pieces of pottery

   723 \item different colours of stones

   724 \item ``facebook''-like authorisation 

   725 \end{itemize}\bigskip

   726 

   727 \textcolor{gray}{problems with vote buying / no ballot privacy}\bigskip

   728 

   729 

   730 \item French Revolution and the US Constitution got things ``started'' with 

   731 paper ballots (you first had to bring your own; later they were pre-printed by parties)

   732 \end{itemize}

   733 \end{frame}}

   734 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   735 

   736 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   737 \mode<presentation>{

   738 \begin{frame}[t]

   739 \frametitle{\begin{tabular}{@ {}c@ {}}Ballot Boxes\end{tabular}}

   740 

   741 Security policies involved with paper ballots:

   742 

   743 \begin{enumerate}

   744 \item you need to check that the ballot box is empty at the start of the poll / no false bottom (to prevent ballot stuffing)

   745 \item you need to guard the ballot box during the poll until counting

   746 \item tallied by a team at the end of the poll (independent observers) 

   747 \end{enumerate}

   748 

   749 \begin{center}

   750 \includegraphics[scale=1.5]{pics/ballotbox.jpg}

   751 \end{center}

   752 

   753 

   754 \end{frame}}

   755 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   756 

   757 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   758 \mode<presentation>{

   759 \begin{frame}[t]

   760 \frametitle{\begin{tabular}{@ {}c@ {}}Paper Ballots\end{tabular}}

   761 

   762 What can go wrong with paper ballots?

   763 

   764 \only<2>{

   765 \begin{center}

   766 \includegraphics[scale=0.8]{pics/tweet.jpg}\\

   767 \footnotesize William M.~Tweed, US Politician in 1860's\\

   768 ``As long as I count the votes, what are you going to do about it?''

   769 \end{center}}

   770 

   771 \only<3>{

   772 \medskip

   773 \begin{center}

   774 \begin{minipage}{10cm}

   775 {\bf Chain Voting Attack}

   776 \begin{enumerate}

   777 \item you obtain a blank ballot and fill it out as you want

   778 \item you give it to a voter outside the polling station

   779 \item voter receives a new blank ballot

   780 \item voter submits prefilled ballot

   781 \item voter gives blank ballot to you, you give money

   782 \item goto 1

   783 \end{enumerate}

   784 \end{minipage}

   785 \end{center}

   786 }

   787 

   788 \end{frame}}

   789 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   790 

   791 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   792 \mode<presentation>{

   793 \begin{frame}[t]

   794 \frametitle{\begin{tabular}{@ {}c@ {}}Mechanical Voting Machines\end{tabular}}

   795 

   796 \begin{itemize}

   797 \item<1-> Lever Voting Machines (ca.~1930 - 1990)

   798 \only<1>{

   799 \begin{center}

   800 \includegraphics[scale=0.56]{pics/leavermachine.jpg}

   801 \end{center}

   802 }

   803 \item<2->Punch Cards (ca.~1950 - 2000)

   804 \only<2>{

   805 \begin{center}

   806 \includegraphics[scale=0.5]{pics/punchcard1.jpg}\;\;

   807 \includegraphics[scale=0.46]{pics/punchcard2.jpg}

   808 \end{center}

   809 }

   810 \end{itemize}

   811 

   812 

   813 

   814 \end{frame}}

   815 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   816 

   817 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   818 \mode<presentation>{

   819 \begin{frame}[t]

   820 \frametitle{\begin{tabular}{@ {}c@ {}}Electronic Voting Machines\end{tabular}}

   821 

   822 \begin{center}

   823 \begin{tabular}{c}

   824 \includegraphics[scale=0.45]{pics/dre1.jpg}\; 

   825 \includegraphics[scale=0.40]{pics/dre2.jpg}\\\hline\\

   826 \includegraphics[scale=0.5]{pics/opticalscan.jpg} 

   827 \end{tabular}

   828 \end{center}

   829 

   830 \only<1->{

   831 \begin{textblock}{5.5}(1,4)

   832 DREs

   833 \end{textblock}}

   834 \only<1->{

   835 \begin{textblock}{5.5}(1,11)

   836 Optical Scan

   837 \end{textblock}}

   838 

   839 \only<2>{

   840 \begin{textblock}{5.5}(0.5,14.5)

   841 all are computers

   842 \end{textblock}}

   843 

   844 \end{frame}}

   845 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   846 

   847 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   848 \mode<presentation>{

   849 \begin{frame}[c]

   850 \frametitle{\begin{tabular}{@ {}c@ {}}DREs\end{tabular}}

   851 

   852 Direct-recording electronic voting machines\\ 

   853 (votes are recorded for example memory cards)

   854 

   855 typically touchscreen machines

   856 

   857 usually no papertrail (hard to add: ballot secrecy)

   858 

   859 \begin{center}

   860 \includegraphics[scale=0.56]{pics/dre1.jpg}

   861 \end{center}

   862 

   863 

   864 \end{frame}}

   865 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   866 

   867 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   868 \mode<presentation>{

   869 \begin{frame}[c]

   870 \frametitle{\begin{tabular}{@ {}c@ {}}Diebold Machines\end{tabular}}

   871 

   872 The work by J.~Alex Halderman:

   873 

   874 \begin{itemize}

   875 \item acquired a machine from an anonymous source\medskip

   876 \item the source code running the machine was tried to keep secret\medskip\pause

   877 

   878 \item first reversed-engineered the machine (extremely tedious)

   879 \item could completely reboot the machine and even install a virus that infects other Diebold machines

   880 \item obtained also the source code for other machines

   881 \end{itemize}

   882 

   883 \end{frame}}

   884 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   885 

   886 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   887 \mode<presentation>{

   888 \begin{frame}[c]

   889 \frametitle{\begin{tabular}{@ {}c@ {}}Diebold Machines\end{tabular}}

   890 

   891 What could go wrong?\pause \;\;Failure-in-depth.\bigskip\pause

   892 

   893 A non-obvious problem:

   894 

   895 \begin{itemize}

   896 \item you can nowadays get old machines, which still store old polls

   897 

   898 \item the paper ballot box needed to be secured during the voting until counting;

   899 e-voting machines need to be secured during the entire life-time  

   900 \end{itemize}

   901 

   902 \end{frame}}

   903 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   904 

   905 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   906 \mode<presentation>{

   907 \begin{frame}[c]

   908 \frametitle{\begin{tabular}{@ {}c@ {}}Paper Trail\end{tabular}}

   909 

   910 Conclusion:\\ Any electronic solution should have a paper trail.

   911 

   912 \begin{center}

   913 \begin{tabular}{c}

   914 \includegraphics[scale=0.5]{pics/opticalscan.jpg} 

   915 \end{tabular}

   916 \end{center}\pause

   917 

   918 You still have to solve problems about

   919 Voter registration, voter authentification, guarding against tampering

   920 

   921 \end{frame}}

   922 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%   

   923 

   924 

   925 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

   926 \mode<presentation>{

   927 \begin{frame}[c]

   928 \frametitle{\begin{tabular}{@ {}c@ {}}E-Voting in India\end{tabular}}

   929 

   930 Their underlying engineering principle is ``keep-it-simple'':

   931 

   932 \begin{center}

   933 \begin{tabular}{c}

   934 \includegraphics[scale=1.05]{pics/indiaellection.jpg}\;\;

   935 \includegraphics[scale=0.40]{pics/india1.jpg}

   936 \end{tabular}

   937 \end{center}\medskip\pause

   938